Headline
CVE-2023-34098: SW-27070 - improve htaccess · shopware5/shopware@b3518c8
Shopware is an open source e-commerce software. Due to an incorrect configuration in the .htaccess
file, the configuration file of the Javascript could be read in production environments (themes/package-lock.json
). With this information, the specific Shopware version in a deployment might be determined by an attacker, which could be used for further attacks. Users are advised to update to version 5.7.18. There are no known workarounds for this vulnerability.
Skip to content
Sign up
Actions
Automate any workflow
Packages
Host and manage packages
Security
Find and fix vulnerabilities
Codespaces
Instant dev environments
Copilot
Write better code with AI
Code review
Manage code changes
Issues
Plan and track work
Discussions
Collaborate outside of code
Explore
* All features
* Documentation
* GitHub Skills
* Blog
For
- Enterprise
- Teams
- Startups
- Education
By Solution
- CI/CD & Automation
- DevOps
- DevSecOps
Case Studies
- Customer Stories
- Resources
GitHub Sponsors
Fund open source developers
* The ReadME Project
GitHub community articles
Repositories
* Topics
* Trending
* Collections
Pricing
In this repository All GitHub
No suggested jump to results
In this repository All GitHub
In this organization All GitHub
In this repository All GitHub
Sign in
Sign up
shopware5 / shopware Public
- Notifications
- Fork 846
- Star 1.3k
- Code
- Issues
- Pull requests 4
- Discussions
- Actions
- Wiki
- Security
- Insights
More
Commit
Permalink
Browse files
Browse the repository at this point in the history
SW-27070 - improve htaccess
- Loading branch information
PascalThesing committed
May 2, 2023
1 parent 2e2e0b6 commit b3518c8
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion .htaccess.dist
Show comments View file
Expand Up
@@ -39,7 +39,7 @@ RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization},L]
RedirectMatch 404 /(web\/cache\/(config_\d+\.json|all.less))$
# Restrict access to theme configurations
RedirectMatch 404 /themes/(.*)(.*\.lock|package\.json|\.gitignore|Gruntfile\.js|all\.less|node_modules\/.*)$
RedirectMatch 404 /themes/(.*)(.(lock|package)\.json|\.gitignore|Gruntfile\.js|all\.less|node_modules\/.*)$
</IfModule>
# Staging environment
Expand Down
0 comments on commit b3518c8
Please sign in to comment.
Related news
### Impact Due to a wrong configuration in the `.htaccess` file, the configuration file of Javascript dependencies could be read in production environments (`themes/package-lock.json`). With this information, the used Shopware version might be determined by an attacker, which could be used for further attacks. ### Patches We recommend updating to the current version 5.7.18. You can get the update to 5.7.18 regularly via the Auto-Updater or directly via the release page. https://github.com/shopware5/shopware/releases/tag/v5.7.18 For older versions you can use the Security Plugin: https://store.shopware.com/en/swag575294366635f/shopware-security-plugin.html ### References https://docs.shopware.com/en/shopware-5-en/security-updates/security-update-06-2023